# Hacking Attempt **URL:** \ **Category:** General\ **Created:** [October 26, 2026, 3:01am UTC](https://community.foundation.xyz/t/hacking-attempt/1290 "2026-10-26T03:01:48Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![alpacastan22m](https://community.foundation.xyz/letter_avatar_proxy/v4/letter/a/97f17d/32.png) [@alpacastan22m](https://community.foundation.xyz/u/alpacastan22m)\ **Post date:** [October 26, 2026, 3:01am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/1 "2026-10-26T03:01:48Z")
Hackers are getting creative. ![IMG_2379](https://community.foundation.xyz/uploads/default/original/2X/8/8df342c8e0efa7bf2867917fe0614217c7b5677c.jpeg) ---
**Author:** ![Whitedog](https://community.foundation.xyz/letter_avatar_proxy/v4/letter/w/5e9695/32.png) [@Whitedog](https://community.foundation.xyz/u/Whitedog)\ **Post date:** [October 26, 2026, 3:08am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/2 "2026-10-26T03:08:56Z")
Yes I just got it as well. ---
**Author:** ![Mason.99999](https://community.foundation.xyz/user_avatar/community.foundation.xyz/mason.99999/32/730_2.png) [@Mason.99999](https://community.foundation.xyz/u/Mason.99999)\ **Post date:** [October 26, 2026, 3:12am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/3 "2026-10-26T03:12:24Z")
It seems they at least succeeded in hacking the customer database and are now social engineering crypto theft. ---
**Author:** ![911f5a746cfe2836](https://community.foundation.xyz/letter_avatar_proxy/v4/letter/9/df705f/32.png) [@911f5a746cfe2836](https://community.foundation.xyz/u/911f5a746cfe2836)\ **Post date:** [October 26, 2026, 3:17am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/4 "2026-10-26T03:17:03Z")
Our names and email addresses, minimum, are compromised. I wonder if our postal addresses were also exposed to the Internet. ---
**Author:** ![Scriptshaman\_Ji](https://community.foundation.xyz/user_avatar/community.foundation.xyz/scriptshaman_ji/32/958_2.png) [@Scriptshaman\_Ji](https://community.foundation.xyz/u/Scriptshaman_Ji)\ **Post date:** [October 26, 2026, 3:18am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/5 "2026-10-26T03:18:55Z")
Mine is yeah… They have you delivery address ---
**Author:** ![911f5a746cfe2836](https://community.foundation.xyz/letter_avatar_proxy/v4/letter/9/df705f/32.png) [@911f5a746cfe2836](https://community.foundation.xyz/u/911f5a746cfe2836)\ **Post date:** [October 26, 2026, 3:22am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/6 "2026-10-26T03:22:31Z")
They might also have our billing addresses and phone numbers. ---
**Author:** ![alpacastan22m](https://community.foundation.xyz/letter_avatar_proxy/v4/letter/a/97f17d/32.png) [@alpacastan22m](https://community.foundation.xyz/u/alpacastan22m)\ **Post date:** [October 26, 2026, 3:24am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/7 "2026-10-26T03:24:49Z")
Did you guys get an email from the official foundation email address though? Tell me this is a fake?! ---
**Author:** ![911f5a746cfe2836](https://community.foundation.xyz/letter_avatar_proxy/v4/letter/9/df705f/32.png) [@911f5a746cfe2836](https://community.foundation.xyz/u/911f5a746cfe2836)\ **Post date:** [October 26, 2026, 3:31am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/8 "2026-10-26T03:31:02Z")
Mail headers look to me like `159.112.252.180` broke into Foundation’s Mailgun account. Correction: `159.112.252.180` _is_ Mailgun. But the point stands that I think someone broke into Foundation’s Mailgun account. ---
**Author:** ![DAG](https://community.foundation.xyz/user_avatar/community.foundation.xyz/dag/32/174_2.png) [@DAG](https://community.foundation.xyz/u/DAG)\ **Post date:** [October 26, 2026, 3:33am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/9 "2026-10-26T03:33:07Z")
Whats going on here guys? I recieved the email too ---
**Author:** ![deepskydiver](https://community.foundation.xyz/user_avatar/community.foundation.xyz/deepskydiver/32/181_2.png) [@deepskydiver](https://community.foundation.xyz/u/deepskydiver)\ **Post date:** [October 26, 2026, 3:34am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/10 "2026-10-26T03:34:05Z")
So at the least the customer database has been compromised. ---
**Author:** ![Socrates](https://community.foundation.xyz/letter_avatar_proxy/v4/letter/s/3bc359/32.png) [@Socrates](https://community.foundation.xyz/u/Socrates)\ **Post date:** [October 26, 2026, 3:35am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/11 "2026-10-26T03:35:55Z")
I got the same. This is not good. They have my email, mobile number and shipping address. ---
**Author:** ![Afrikaners](https://community.foundation.xyz/user_avatar/community.foundation.xyz/afrikaners/32/1046_2.png) [@Afrikaners](https://community.foundation.xyz/u/Afrikaners)\ **Post date:** [October 26, 2026, 3:36am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/12 "2026-10-26T03:36:55Z")
Same, also received it. My email “From” looks completely legit though. Only picked something is not right after clicking the bloody button and seeing it takes met to h t t p s: // foundation.support/, not a Foundation URL. They definitely must have had a Cyber incident leaking all our private details ---
**Author:** ![alpacastan22m](https://community.foundation.xyz/letter_avatar_proxy/v4/letter/a/97f17d/32.png) [@alpacastan22m](https://community.foundation.xyz/u/alpacastan22m)\ **Post date:** [October 26, 2026, 3:37am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/13 "2026-10-26T03:37:18Z")
We’re redirected to create a Wallet on their official website. Guessing no one going to act on this is the right move? ---
**Author:** ![DAG](https://community.foundation.xyz/user_avatar/community.foundation.xyz/dag/32/174_2.png) [@DAG](https://community.foundation.xyz/u/DAG)\ **Post date:** [October 26, 2026, 3:37am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/14 "2026-10-26T03:37:49Z")
The email is telling me to set up a vault though Foundation. This is fucked and was not on my bingo card for the day. What is everyone doing? ---
**Author:** ![deepskydiver](https://community.foundation.xyz/user_avatar/community.foundation.xyz/deepskydiver/32/181_2.png) [@deepskydiver](https://community.foundation.xyz/u/deepskydiver)\ **Post date:** [October 26, 2026, 3:38am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/15 "2026-10-26T03:38:22Z")
Nothing - do nothing until we hear from Foundation. ---
**Author:** ![DAG](https://community.foundation.xyz/user_avatar/community.foundation.xyz/dag/32/174_2.png) [@DAG](https://community.foundation.xyz/u/DAG)\ **Post date:** [October 26, 2026, 3:39am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/16 "2026-10-26T03:39:11Z")
Keep calm and carry on? ---
**Author:** ![alpacastan22m](https://community.foundation.xyz/letter_avatar_proxy/v4/letter/a/97f17d/32.png) [@alpacastan22m](https://community.foundation.xyz/u/alpacastan22m)\ **Post date:** [October 26, 2026, 3:39am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/17 "2026-10-26T03:39:30Z")
Hear from Foundation where though? Nothing on their X feed either ---
**Author:** ![alpacastan22m](https://community.foundation.xyz/letter_avatar_proxy/v4/letter/a/97f17d/32.png) [@alpacastan22m](https://community.foundation.xyz/u/alpacastan22m)\ **Post date:** [October 26, 2026, 3:46am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/18 "2026-10-26T03:46:00Z")
Anyone have an update? ---
**Author:** ![deepskydiver](https://community.foundation.xyz/user_avatar/community.foundation.xyz/deepskydiver/32/181_2.png) [@deepskydiver](https://community.foundation.xyz/u/deepskydiver)\ **Post date:** [October 26, 2026, 3:49am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/19 "2026-10-26T03:49:42Z")
Announcement on Twitter: > **[FOUNDATION (@FoundationHQ) on X](https://x.com/FoundationHQ)** > > Passport Prime is Human Authority Hardware. Secure your Bitcoin, codes, wallets, agents, and apps built with KeyOS SDK. Nothing happens without your approval. ---
**Author:** ![Galneryus](https://community.foundation.xyz/user_avatar/community.foundation.xyz/galneryus/32/126_2.png) [@Galneryus](https://community.foundation.xyz/u/Galneryus)\ **Post date:** [October 26, 2026, 3:50am UTC](https://community.foundation.xyz/t/hacking-attempt/1290/20 "2026-10-26T03:50:45Z")
That mail makes no sense either. How can a screen enable draining of funds. Even if it was able to spoof addresses shown on the display this should be easily discovered before broadcasting the signed transaction. [Next page](https://community.foundation.xyz/t/hacking-attempt/1290.md?page=2)